Security audit

Google Fonts指南

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a Google Fonts reference skill, but it asks for and describes broader command, file-writing, API, and credential-handling capabilities that are not well scoped to that purpose.

Install only if you are comfortable reviewing and constraining the skill to font-related advice. It should not need general automation, command execution, broad file writing, or API credentials for ordinary Google Fonts recommendations; avoid providing secrets and require confirmation before any command, file mutation, or external API use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill presents itself as a Google Fonts guidance document, but the manifest and narrative claim broad workflow automation, file processing, API integration, and command execution capabilities. This mismatch can cause an agent or user to over-trust the skill’s scope and invoke unnecessary privileged tools, increasing the risk of unintended actions beyond simple documentation lookup.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The document describes itself as MD+KNOW with no external dependencies, yet other sections require network services and APIs. This inconsistency can mislead users and agents about what data leaves the environment and what runtime assumptions apply, undermining safe deployment decisions.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The capability and onboarding sections advertise file handling, API calls, and command execution even though the rest of the document is essentially a static font reference. In an agent setting, overstated capabilities can trigger risky tool use or broaden the interpreted permission envelope without a legitimate task need.

Vague Triggers

High

Confidence: 91% confidence
Finding: The activation guidance is overly broad and says to use the skill for general efficiency, automation, batch processing, and workflow optimization, which is unrelated to a narrow font-selection skill. Overbroad routing language can cause the agent to invoke this skill in inappropriate contexts, where its inflated capability claims may lead to unsafe or irrelevant actions.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The example invocation is generic enough that it does not clearly limit use to font guidance. While not directly dangerous on its own, ambiguous invocation patterns contribute to accidental skill misuse and make it easier for broader misleading capability claims to take effect.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill advertises file writing, command execution, and external API use without user-facing warnings about side effects, permissions, or data disclosure. In an agent environment, that omission is dangerous because users may not realize the skill could create files, run commands, or transmit data externally if the platform honors those tool declarations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The onboarding text instructs users to configure API keys and establish API connections without guidance on secret storage, least privilege, redaction, or avoiding exposure in prompts and logs. This creates a realistic pathway for credential mishandling, especially in shared agent or CI environments.

Static analysis

No suspicious patterns detected.